Windows: install the background service without Administrator

The Windows `executor install` / `executor service install` always required
an elevated PowerShell. It registered the daemon as a boot-triggered Scheduled
Task (AtStartup + S4U + RunLevel Highest), and Task Scheduler only lets an
Administrator create that shape. macOS (launchd RunAtLoad) and Linux
(systemd --user) both install per-user with no elevation, so Windows was the
odd one out.

Default to a per-user logon task instead: a LogonTrigger + InteractiveToken
principal at LeastPrivilege, which a standard user may register for themselves.
This matches the launchd/systemd behavior (start at login, unprivileged). The
old boot-before-login behavior is preserved behind an explicit `--boot` flag,
which still needs an Administrator shell and says so.

Register via schtasks.exe rather than the PowerShell *-ScheduledTask cmdlets.
Those cmdlets reach Task Scheduler over CIM/DCOM, whose local-activation check
fails with Access denied (0x80070005) when the compiled binary spawns the
helper on a non-interactive window station; schtasks uses Task Scheduler RPC and
has no such dependency. status/uninstall/restart and the orphaned-listener
cleanup move off CIM too (schtasks query + netstat/taskkill).

A logon task runs in the user's interactive session, so launch the daemon
through a hidden wscript shim to avoid flashing a console window on the desktop
at every login; the shim waits on the wrapper so the task stays Running and
RestartOnFailure is preserved.

Verified on Windows Server 2022 as a standard, non-admin user: `--boot` is
correctly refused, the default install registers a logon task, the daemon comes
up, and /api/health returns 200.

Author: Rhys Sullivan

apps/cli/src/main.ts

@@ -2794,6 +2794,16 @@ const servicePortOption = () =>
     .pipe(Options.withDefault(DEFAULT_SERVICE_PORT))
     .pipe(Options.withDescription("Port the supervised daemon binds (loopback only)."));
 
+const serviceBootOption = () =>
+  Options.boolean("boot")
+    .pipe(Options.withDefault(false))
+    .pipe(
+      Options.withDescription(
+        "Windows only: start the daemon at boot before any login (needs an Administrator shell). " +
+          "Default installs a per-user login task that needs no elevation.",
+      ),
+    );
+
 const serviceManagerName = (platform: ReturnType<typeof getServiceBackend>["platform"]): string => {
   switch (platform) {
     case "darwin":
@@ -2807,7 +2817,7 @@ const serviceManagerName = (platform: ReturnType<typeof getServiceBackend>["plat
   }
 };
 
-const installService = (port: number, commandName: string) =>
+const installService = (port: number, commandName: string, boot = false) =>
   Effect.gen(function* () {
     const command = `${cliPrefix} ${commandName}`;
     if (isDevMode) {
@@ -2824,7 +2834,12 @@ const installService = (port: number, commandName: string) =>
     const backend = getServiceBackend();
     if (!backend.automated) {
       // Unsupported platforms surface their manual steps via the install error.
-      yield* backend.install({ executablePath: process.execPath, port, version: CLI_VERSION });
+      yield* backend.install({
+        executablePath: process.execPath,
+        port,
+        version: CLI_VERSION,
+        boot,
+      });
       return;
     }
 
@@ -2881,7 +2896,7 @@ const installService = (port: number, commandName: string) =>
     // The unit carries no secret: the supervised daemon mints/loads its bearer
     // from auth.json (under EXECUTOR_DATA_DIR) on first boot, and clients read
     // the same file — so reachability is the credential-free /api/health probe.
-    yield* backend.install({ executablePath: process.execPath, port, version: CLI_VERSION });
+    yield* backend.install({ executablePath: process.execPath, port, version: CLI_VERSION, boot });
 
     console.log(`Waiting for Executor to publish its service manifest at ${origin}...`);
     const reachable = yield* waitForReachable({
@@ -2904,16 +2919,21 @@ const installService = (port: number, commandName: string) =>
     }
 
     console.log(`Executor is now running as a background service at ${origin}.`);
-    console.log("It keeps serving after you quit the app and restarts on login.");
+    console.log(
+      boot && backend.platform === "win32"
+        ? "It keeps serving after you quit the app and starts at boot, before login."
+        : "It keeps serving after you quit the app and restarts on login.",
+    );
     console.log(`Open it in your browser, already signed in, with:  ${cliPrefix} web`);
   });
 
 const serviceInstallCommand = Command.make(
   "install",
   {
     port: servicePortOption(),
+    boot: serviceBootOption(),
   },
-  ({ port }) => installService(port, "service install"),
+  ({ port, boot }) => installService(port, "service install", boot),
 ).pipe(
   Command.withDescription("Install and start Executor as an OS-supervised background service"),
 );
@@ -2996,8 +3016,9 @@ const installCommand = Command.make(
   "install",
   {
     port: servicePortOption(),
+    boot: serviceBootOption(),
   },
-  ({ port }) => installService(port, "install"),
+  ({ port, boot }) => installService(port, "install", boot),
 ).pipe(
   Command.withDescription("Install and start Executor as an OS-supervised background service"),
 );

apps/cli/src/service.test.ts

@@ -5,9 +5,10 @@ import {
   generateLaunchdPlist,
   generateSystemdUnit,
   generateWindowsDaemonWrapper,
-  generateWindowsRegisterScript,
-  generateWindowsStopExecutorListenersScript,
+  generateWindowsHiddenLauncherVbs,
+  generateWindowsTaskXml,
   getServiceBackend,
+  parseNetstatListenerPids,
 } from "./service";
 
 describe("service unit generation", () => {
@@ -124,28 +125,68 @@ describe("service unit generation", () => {
     expect(`set "PATH=${cmdSetValue('a"&b')}"`).not.toMatch(/"\s*&/);
   });
 
-  it("registers a boot-triggered S4U task (the reboot-survival contract)", () => {
-    const script = generateWindowsRegisterScript({
-      taskName: "ExecutorDaemon",
-      wrapperPath: "C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd",
-      userId: "x",
+  it("defaults to a per-user logon task that needs no elevation", () => {
+    const xml = generateWindowsTaskXml({
+      command: "wscript.exe",
+      arguments: '"C:\\Users\\x\\.executor\\server-control\\run-daemon.vbs"',
+      userId: "HOST\\x",
     });
-    // S4U + AtStartup = run as the user, at boot, no stored password, no logon.
-    expect(script).toContain("-LogonType S4U");
-    expect(script).toContain("New-ScheduledTaskTrigger -AtStartup");
-    expect(script).toContain("-RestartCount 3");
-    expect(script).toContain("Register-ScheduledTask -TaskName 'ExecutorDaemon'");
-    expect(script).toContain("Start-ScheduledTask -TaskName 'ExecutorDaemon'");
+    // LogonTrigger + InteractiveToken + LeastPrivilege = run as the user at their
+    // own logon, unprivileged. A standard user may register this without admin.
+    expect(xml).toContain("<LogonTrigger><Enabled>true</Enabled><UserId>HOST\\x</UserId>");
+    expect(xml).toContain("<LogonType>InteractiveToken</LogonType>");
+    expect(xml).toContain("<RunLevel>LeastPrivilege</RunLevel>");
+    // The default path must NOT use the admin-only Boot/S4U/Highest knobs.
+    expect(xml).not.toContain("BootTrigger");
+    expect(xml).not.toContain("S4U");
+    expect(xml).not.toContain("HighestAvailable");
+    expect(xml).toContain("<RestartOnFailure><Interval>PT1M</Interval><Count>3</Count>");
+    expect(xml).toContain("<Command>wscript.exe</Command>");
+    expect(xml).toContain("run-daemon.vbs&quot;</Arguments>");
   });
 
-  it("stops orphaned executor.exe listeners without shadowing PowerShell's $PID", () => {
-    const script = generateWindowsStopExecutorListenersScript(4789);
+  it("registers a boot-triggered S4U task under --boot (the reboot-survival contract)", () => {
+    const xml = generateWindowsTaskXml({
+      command: "wscript.exe",
+      arguments: '"C:\\Users\\x\\.executor\\server-control\\run-daemon.vbs"',
+      userId: "HOST\\x",
+      boot: true,
+    });
+    // BootTrigger + S4U + HighestAvailable = run as the user, at boot, no stored
+    // password, no logon. Task Scheduler only lets an elevated shell create this.
+    expect(xml).toContain("<BootTrigger><Enabled>true</Enabled></BootTrigger>");
+    expect(xml).toContain("<LogonType>S4U</LogonType>");
+    expect(xml).toContain("<RunLevel>HighestAvailable</RunLevel>");
+    expect(xml).not.toContain("LogonTrigger");
+    expect(xml).not.toContain("InteractiveToken");
+  });
+
+  it("hides the daemon console via a wait-and-propagate wscript shim", () => {
+    const vbs = generateWindowsHiddenLauncherVbs(
+      "C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd",
+    );
+    // Run(cmd, 0, True): 0 = hidden window, True = wait so the task stays Running
+    // and the wrapper's exit code propagates (preserving RestartOnFailure).
+    expect(vbs).toContain(
+      'sh.Run("""C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd""", 0, True)',
+    );
+    expect(vbs).toContain("WScript.Quit rc");
+  });
 
-    expect(script).toContain("Get-NetTCPConnection -LocalPort 4789 -State Listen");
-    expect(script).toContain("$listenerPid");
-    expect(script).not.toContain("foreach ($pid");
-    expect(script).toContain("[string]$process.Name -ieq 'executor.exe'");
-    expect(script).toContain('Write-Output ("STOPPED=" + $listenerPid)');
+  it("parses LISTENING pids for the service port from netstat output", () => {
+    const netstat = [
+      "Active Connections",
+      "  Proto  Local Address          Foreign Address        State           PID",
+      "  TCP    127.0.0.1:4789         0.0.0.0:0              LISTENING       4072",
+      "  TCP    127.0.0.1:4789         127.0.0.1:51000       ESTABLISHED     4072",
+      "  TCP    [::1]:4789             [::]:0                LISTENING       4072",
+      "  TCP    0.0.0.0:445            0.0.0.0:0             LISTENING       4",
+      "  TCP    127.0.0.1:8765         0.0.0.0:0             LISTENING       9999",
+    ].join("\r\n");
+    expect(parseNetstatListenerPids(netstat, 4789)).toEqual([4072]);
+    // A connection in another state on the port must not be treated as a listener.
+    expect(parseNetstatListenerPids(netstat, 445)).toEqual([4]);
+    expect(parseNetstatListenerPids(netstat, 1234)).toEqual([]);
   });
 });